MODiX icon indicating copy to clipboard operation
MODiX copied to clipboard

Add flag to IAuthorizationService to ignore authorization checks

Open Scott-Caldwell opened this issue 7 years ago • 1 comments

Referencing https://github.com/discord-csharp/MODiX/pull/223#issuecomment-440479545.

We should consider the idea of adding a flag in IAuthorizationService that would indicate that a user ignores authorization checks.

Proposed details:

  1. Type should be non-nullable bool.
  2. Value should be true when the user is an administrator (i.e. has the Administrator guild-level permission) or when the user is MODiX.
  3. Should affect all authorization checks in all services.
  4. Should affect rank validation checks.

This is a potentially dangerous feature. Is there anything that should be added/changed/removed to mitigate the chances of exploitation?

Scott-Caldwell avatar Nov 23 '18 03:11 Scott-Caldwell

Regarding #3, webshouldnsimply attempt to do all auth checks within thebservice itself. The only obvious spot right now (that I can think of) where we don't is with the RequireRankGreaterThanOrEqualToModerator() method (or whatever it's called) in IModerationService. This could easily be refactored into IAuthorizationService, regardless if any other services actually ever need it.

JakenVeina avatar Nov 25 '18 06:11 JakenVeina

As part of a new effort to refocus on priorities, I will close this. If you feel this is imperative to the bot, a new issue can be opened to supersede this.

patrickklaeren avatar Mar 26 '24 14:03 patrickklaeren